HMAC Generator
100% PrivateSecurity & Privacy UtilitiesCompute HMAC signatures for a message with a shared secret key, using Web Crypto.
Runs entirely in your browser. Your input is not uploaded to Ovatly or anywhere else.
HMAC proves a message came from someone who knows the key and was not changed on the way. It is authentication, not encryption: anyone with the key can read the message itself.
- 1Paste the exact message that will be signed, byte for byte.
- 2Enter the shared secret key.
- 3Pick SHA-256, SHA-384 or SHA-512.
- 4Press Compute HMAC and copy the format your system expects.
With the key set to the word key and the message The quick brown fox jumps over the lazy dog, HMAC-SHA-256 is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. If your own code produces a different value for these inputs, the bug is in the code, not in this tool.
- Key and message are processed on your device only. Still, do not sign production secrets on a machine you do not trust.
- Whitespace and line endings are part of the message: a trailing newline changes the signature completely.
- HMAC authenticates; it does not encrypt. Anyone holding the key can both sign and verify, so it suits shared-secret setups, not public-key signatures.
- Only SHA-256 and stronger are offered; HMAC-SHA-1 and HMAC-MD5 are legacy and deliberately omitted.
Almost always a byte-level difference: a trailing newline, a different encoding, a hex key being treated as text (or the reverse), or signing a re-serialised JSON body instead of the raw bytes that were sent.
About this tool
The HMAC Generator signs a message with a shared secret key using your browser's Web Crypto API, and shows the signature in hex and Base64. Developers use it to test webhook signatures, API request signing and message authentication without sending their key or message to a server.
Related tools
Part of Ovatly's free tools in Security & Privacy Utilities.